funksec
First seen December 4, 2024Active172 claimed victims
The claims below are reproduced as posted by funksec on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
FunkSec is an AI-assisted ransomware-as-a-service group that launched its data leak site in December 2024 and rapidly claimed over 85 victims across government, technology, finance, and education sectors globally, demanding unusually low ransoms and using AI tooling to lower the technical bar for affiliates.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| semaphore.asso.fr | March 18, 2025 | ransomware_live | — |
| unimore.it | March 12, 2025 | ransomware_live | — |
| extremeperformance.com | March 12, 2025 | ransomware_live | — |
| isee-eg.com | March 11, 2025 | ransomware_live | — |
| klabs.it | March 9, 2025 | ransomware_live | — |
| univ-rennes.fr | March 8, 2025 | ransomware_live | — |
| sorbonne-universite.fr | March 7, 2025 | ransomware_live | — |
| cimenyan.desa.id | March 4, 2025 | ransomware_live | — |
| mandarin.com.br | February 28, 2025 | ransomware_live | — |
| stayzapp.in | February 28, 2025 | ransomware_live | — |
| mytower.com.br | February 28, 2025 | ransomware_live | — |
| rossmanmedia.ae | February 19, 2025 | ransomware_live | — |
| footballticketnet.com | February 18, 2025 | ransomware_live | — |
| hiway.com.br | February 17, 2025 | ransomware_live | — |
| avtovelomoto.by | February 12, 2025 | ransomware_live | — |
| phidac.be | February 8, 2025 | ransomware_live | — |
| autogedal.ro | February 7, 2025 | ransomware_live | — |
| iaaglobal.org | February 7, 2025 | ransomware_live | — |
| herbalcanadaonline.com | February 7, 2025 | ransomware_live | — |
| cara.com.my | February 5, 2025 | ransomware_live | — |
| rattelacademy.com | February 5, 2025 | ransomware_live | — |
| forum-rainbow-rp.forumotion.eu | February 4, 2025 | ransomware_live | — |
| esle.eu | February 4, 2025 | ransomware_live | — |
| brainsystem.eu | February 4, 2025 | ransomware_live | — |
| fasttrackcargo.com | February 3, 2025 | ransomware_live | — |
| hreu.eu | February 2, 2025 | ransomware_live | — |
| myisp.live | February 1, 2025 | ransomware_live | — |
| tirtaraharja.co.id | February 1, 2025 | ransomware_live | — |
| fiberskynet.net | February 1, 2025 | ransomware_live | — |
| dms-ksa.com | January 31, 2025 | ransomware_live | — |
| inmobiliariamaspormenos.com | January 31, 2025 | ransomware_live | — |
| tsmx.net.br | January 28, 2025 | ransomware_live | — |
| treehotel.co.uk | January 27, 2025 | ransomware_live | — |
| qed.co.ug | January 27, 2025 | ransomware_live | — |
| punjab.gov.in | January 26, 2025 | ransomware_live | — |
| achieverssciencejournal.org | January 26, 2025 | ransomware_live | — |
| genrepurchase.bankatm.in | January 24, 2025 | ransomware_live | — |
| punjab.gov.pk | January 23, 2025 | ransomware_live | — |
| iptime.com | January 22, 2025 | ransomware_live | — |
| insta.com.pk | January 21, 2025 | ransomware_live | — |
| thecitybank.com | January 21, 2025 | ransomware_live | — |
| cu-barika.dz | January 21, 2025 | ransomware_live | — |
| ayswrewards.cow | January 21, 2025 | ransomware_live | — |
| navy-mil-bd | January 21, 2025 | ransomware_live | — |
| aquamanaesp.gov.co | January 17, 2025 | ransomware_live | — |
| barilga.gov.mn | January 15, 2025 | ransomware_live | — |
| mts.gov.eg | January 15, 2025 | ransomware_live | — |
| bluai.ai | January 14, 2025 | ransomware_live | — |
| zapopan.gob.mx | January 13, 2025 | ransomware_live | — |
| linxe.com | January 13, 2025 | ransomware_live | — |
| kuzstu-nf.ru | January 13, 2025 | ransomware_live | — |
| mymobileforms app | January 13, 2025 | ransomware_live | — |
| wissenhive.com | January 12, 2025 | ransomware_live | — |
| seocommarrakech.com | January 11, 2025 | ransomware_live | — |
| carc.gov.jo | January 9, 2025 | ransomware_live | — |
| mindev.gov.gr | January 9, 2025 | ransomware_live | — |
| gags.gov.eg | January 9, 2025 | ransomware_live | — |
| senergy.net | January 7, 2025 | ransomware_live | — |
| ndceg.com | January 7, 2025 | ransomware_live | — |
| bayan-ulgii.cfga.gov.mn | January 5, 2025 | ransomware_live | — |
| ribernuez.com | January 5, 2025 | ransomware_live | — |
| technotouch.co | January 4, 2025 | ransomware_live | — |
| gsw.co.in | January 4, 2025 | ransomware_live | — |
| scps.mp.gov.in | January 1, 2025 | ransomware_live | — |
| banksulutgo | December 31, 2024 | ransomware_live | — |
| maim.gov.my | December 31, 2024 | ransomware_live | — |
| tsag-agaar.gov.mn | December 31, 2024 | ransomware_live | — |
| moh.gov.vn | December 31, 2024 | ransomware_live | — |
| equitiesnagain.com | December 30, 2024 | ransomware_live | — |
| bitnato.one | December 30, 2024 | ransomware_live | — |
| dcd.gov.ae | December 30, 2024 | ransomware_live | — |
| moph.gov.lb | December 30, 2024 | ransomware_live | — |
| mofaga.gov.np | December 30, 2024 | ransomware_live | — |
| apexfootwearltd.com | December 30, 2024 | ransomware_live | — |
| mof.gov.la | December 30, 2024 | ransomware_live | — |
| deportesapalategui.com | December 29, 2024 | ransomware_live | — |
| shoppingcentropioneer.com | December 28, 2024 | ransomware_live | — |
| nppvlxdthanhlong.com.vn | December 28, 2024 | ransomware_live | — |
| asjp.cerist.dz | December 28, 2024 | ransomware_live | — |
| netox.net | December 25, 2024 | ransomware_live | — |
| devoutdigital.com | December 25, 2024 | ransomware_live | — |
| asjp.cerist.dz sell | December 24, 2024 | ransomware_live | — |
| egyptair.com 5 sell | December 24, 2024 | ransomware_live | — |
| itc.gov.ae with 1K ! | December 24, 2024 | ransomware_live | — |
| 2sign.co.il | December 24, 2024 | ransomware_live | — |
| 10M israeli data for sell | December 23, 2024 | ransomware_live | — |
| asiapacfish.org | December 23, 2024 | ransomware_live | — |
| kfar-yona.muni.il | December 23, 2024 | ransomware_live | — |
| egyptair.com 5 with 10K ! | December 23, 2024 | ransomware_live | — |
| gtsportcarrental.com | December 22, 2024 | ransomware_live | — |
| casarom.com.ar | December 22, 2024 | ransomware_live | — |
| visualsystemas.com.ar | December 22, 2024 | ransomware_live | — |
| carsbeat.com | December 21, 2024 | ransomware_live | — |
| fusioncharts.com | December 21, 2024 | ransomware_live | — |
| news.gdi.gov.kh | December 21, 2024 | ransomware_live | — |
| sklepbaterie.pl | December 20, 2024 | ransomware_live | — |
| HostingExpress.com.mx | December 20, 2024 | ransomware_live | — |
| ndc.energy.mn | December 20, 2024 | ransomware_live | — |
| web.vaips.cl | December 19, 2024 | ransomware_live | — |
| agti.eng.br | December 19, 2024 | ransomware_live | — |
Page 1 of 2Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).